Equipment access authentication method and device, equipment and storage medium

Abstract

The invention relates to the technical field of equipment access authentication, and discloses an equipment access authentication method and device, equipment and a storage medium. The method comprises the following steps: monitoring and collecting server equipment to obtain a first server feature vector; processing through a time domain multiple sparse Bayesian learning algorithm to obtain a server behavior reference model; calculating a second server feature vector collected in real time to obtain a server state abnormity score; triggering a multi-modal analysis program and carrying out deep evaluation to obtain a server abnormal behavior report; analyzing through a deep reinforcement learning algorithm to generate a server dynamic access control strategy; according to the method, a device access authentication system which is safer, more reliable and higher in adaptability is constructed by comprehensively and dynamically analyzing device behaviors and combining an intelligent algorithm and a cooperative defense mechanism so as to cope with various security challenges in the current network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of device access authentication, and in particular to a device access authentication method, device, equipment and storage medium. Background Art

[0002] With the rapid development of cloud computing, the Internet of Things, and 5G technologies, device access authentication methods are becoming increasingly important in the field of network security. Traditional static password and certificate-based authentication methods face many challenges, such as security threats such as credential leakage, man-in-the-middle attacks, and replay attacks. At the same time, the complexity and dynamic nature of heterogeneous network environments also increase the difficulty of device identity authentication. Existing authentication methods often have difficulty coping with highly dynamic and complex network environments, and lack the ability to continuously monitor device behavior and detect anomalies.

[0003] In addition, as network attack methods continue to evolve, single-dimensional authentication methods can no longer meet increasingly stringent security needs. Attackers may bypass traditional authentication mechanisms by simulating the behavior of normal devices, leading to potential security risks. Therefore, there is an urgent need for an authentication method that can comprehensively analyze the multi-dimensional characteristics of devices and has the ability to continuously monitor and dynamically adjust. Summary of the invention

[0004] The present invention provides a device access authentication method, apparatus, device and storage medium. The present invention constructs a more secure, reliable and adaptable device access authentication system through a comprehensive and dynamic analysis of device behavior, combined with intelligent algorithms and collaborative defense mechanisms, to cope with various security challenges in the current network environment.

[0005] In a first aspect, the present invention provides a device access authentication method, the device access authentication method comprising: Monitor and collect network traffic patterns, system call sequences, and hardware fingerprints of the server device to obtain a first server feature vector; Inputting the first server feature vector into a time-domain multiple sparse Bayesian learning algorithm for processing to obtain a server behavior benchmark model; Comparing and calculating the deviation of the second server feature vector collected in real time based on the server behavior benchmark model to obtain a server status anomaly score; triggering a multimodal analysis program according to the server status anomaly score to conduct an in-depth evaluation of fine-grained server status information and obtain a server abnormal behavior report; Inputting the server abnormal behavior report into a deep reinforcement learning algorithm for analysis to generate a server dynamic access control strategy; Based on the server dynamic access control strategy, a security information sharing channel is established in a heterogeneous server network to perform network collaborative defense operations.

[0006] In a second aspect, the present invention provides a device access authentication device, the device access authentication device comprising: A monitoring module, used to monitor and collect network traffic patterns, system call sequences, and hardware fingerprints of the server device to obtain a first server feature vector; A processing module, configured to input the first server feature vector into a time-domain multiple sparse Bayesian learning algorithm for processing to obtain a server behavior benchmark model; A calculation module, used for comparing and calculating the deviation of the second server feature vector collected in real time based on the server behavior benchmark model to obtain a server status anomaly score; An evaluation module, configured to trigger a multimodal analysis program according to the server status anomaly score, conduct an in-depth evaluation of fine-grained server status information, and obtain a server abnormal behavior report; An analysis module is used to input the server abnormal behavior report into a deep reinforcement learning algorithm for analysis and generate a server dynamic access control strategy; The execution module is used to establish a security information sharing channel in a heterogeneous server network based on the server dynamic access control strategy and perform network collaborative defense operations.

[0007] The third aspect of the present invention provides a device access authentication device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the device access authentication device executes the above-mentioned device access authentication method.

[0008] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned device access authentication method.

[0009] In the technical solution provided by the present invention, by simultaneously monitoring and analyzing network traffic patterns, system call sequences and hardware fingerprints, multi-dimensional verification of device identity is achieved, greatly improving the accuracy and reliability of authentication. The server behavior benchmark model is constructed by using a time-domain multiple sparse Bayesian learning algorithm, which can adaptively learn and update the normal behavior pattern of the device and effectively respond to the dynamic changes of the network environment. By comparing and calculating the deviation of the feature vectors collected in real time, combined with multimodal analysis, abnormal behavior can be identified in a timely and accurate manner, reducing the false alarm rate and missed alarm rate. The introduction of a deep reinforcement learning algorithm realizes the generation of intelligent access control strategies based on abnormal behavior reports, improving the pertinence and effectiveness of defense measures. A security information sharing channel is established in a heterogeneous server network, realizing cross-device and cross-network collaborative defense, and enhancing the security of the overall network. The modular design is adopted, and the logic between each step is clear, which is easy to deploy and expand in different network environments. Through real-time data collection and analysis, continuous monitoring of device behavior is achieved, and potential security threats can be discovered and responded to in a timely manner. In the process of abnormal detection, an adaptive threshold algorithm is introduced, which can dynamically adjust the judgment criteria according to the distribution of historical data, thereby improving the flexibility and accuracy of detection. After detecting an anomaly, it can trigger fine-grained multimodal analysis to deeply evaluate the nature and impact of abnormal behavior and provide detailed basis for subsequent defense. In the collaborative defense process, encrypted communication tunnels and distributed security agent networks ensure the secure transmission and sharing of defense information to prevent information leakage and tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0011] Figure 1 A schematic diagram of a process flow of a device access authentication method provided in an embodiment of the present application; Figure 2 A schematic block diagram of the structure of a device access authentication apparatus provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0013] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change based on actual conditions.

[0014] It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0015] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0016] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0017] See also Figure 1 , Figure 1 A schematic diagram of a process flow of a device access authentication method provided in an embodiment of the present application, such as Figure 1 As shown, the device access authentication method provided in the embodiment of the present application includes steps S100 to S600.

[0018] Step S100: monitoring and collecting the network traffic pattern, system call sequence and hardware fingerprint of the server device to obtain a first server feature vector; It is understandable that the execution subject of the present invention may be a device access authentication device, or a terminal or a server, which is not limited here. The embodiment of the present invention is described by taking a server as the execution subject as an example.

[0019] Specifically, the network interface of the server device is used to capture data packets, and the protocol type, size and timestamp information of the data packets are extracted, which constitute the original data of the network traffic. The original data of the network traffic is segmented according to the predefined time window, and the fixed time interval is used as the segmentation standard. In each time window, the number, size distribution, protocol type distribution and other characteristics of the data packets are statistically analyzed, and the characteristic subvector of the network traffic is extracted to reflect the network communication behavior characteristics of the server in the time window. At the same time, the system call kernel of the server device is tracked, the type, parameters and return value of the system call are recorded, and the original data of the system call sequence is obtained to reflect the behavior of the server at the operating system level in a certain time period. The original data of the system call sequence is converted into the system call frequency distribution, and the local sequence pattern is extracted, such as the frequently occurring system call sequence fragments, to obtain the characteristic subvector of the system call, reflecting the behavior pattern of the server. The hardware component information of the server is collected, including information such as CPU identification, memory capacity, disk serial number and network card MAC address. In order to protect privacy and simplify the processing flow, the original hardware information is converted through a hash function to generate a unique hardware fingerprint identification. Perform dimensionality reduction processing on the network traffic feature subvector, system call feature subvector and hardware feature subvector. Compress the original high-dimensional feature vector to a lower dimension through principal component analysis and other methods, while retaining its main features as much as possible. Normalize the feature subvectors after dimensionality reduction to keep the data scales of different feature subvectors consistent, so as to avoid adverse effects on subsequent calculations due to different feature dimensions. Perform weighted summation on the normalized network traffic feature subvector, system call feature subvector and hardware feature subvector to obtain a comprehensive feature vector. Assign different weights according to the importance of different features to fully reflect the contribution of each feature to server authentication. Associate the comprehensive feature vector with the server's identity information, construct a data structure containing feature data and identity information, and obtain the first server feature vector.

[0020] Step S200: Input the first server feature vector into the time-domain multiple sparse Bayesian learning algorithm for processing to obtain a server behavior benchmark model; Specifically, the first server feature vector is decomposed into a time series by decomposing the feature vector into several subsequences in time order to obtain the decomposed time series features. The decomposed time series features can reflect the dynamic characteristics of server behavior changing over time. A multivariate autoregressive model is constructed based on the time series features, and the initial time series model is obtained by modeling the interdependence between the time series features. The initial time series model is used as prior knowledge and combined with the Bayesian statistical method to construct a time domain multiple sparse Bayesian model framework. The Bayesian model combines prior knowledge and observation data to infer the model under uncertainty. The initial time series model is introduced into the Bayesian model as prior information to form a Bayesian prior model. In order to improve the prediction ability and accuracy of the model, variational inference is performed on the Bayesian prior model. The parameters of the model are optimized by maximizing the lower bound of evidence to obtain the optimized Bayesian model. The variational inference process uses the approximate inference method to find the parameter configuration that makes the observed data and the model fit best, so that the model can better capture the complex change pattern of server behavior. Based on the optimized Bayesian model, the sparsity of each feature in the time domain is calculated, and the activity of the features at different time points is analyzed to obtain the time domain feature importance score. This score reflects the contribution of each time series feature to the overall model at different time points. According to the time domain feature importance score, the optimized Bayesian model is sparsely processed to eliminate redundant features that contribute less to model prediction, and a time domain sparse Bayesian model is obtained. The time domain sparse Bayesian model is sampled multiple times, and the posterior distribution of the model parameters is generated by the Monte Carlo method to obtain the time domain model parameter distribution. This distribution can describe the possible value range of the model parameters under different conditions. Based on the time domain model parameter distribution, sub-models of multiple time scales are constructed, that is, the model is trained in different time windows to capture the short-term, medium-term and long-term changing trends of server behavior, and a multi-scale time domain model set is obtained. The multi-scale time domain model set is integrated and learned, and a global integrated time domain model is obtained by integrating the prediction results at different time scales. This model can make more accurate comprehensive predictions of server behavior at different time scales. In order to establish a connection between the integrated time domain model and the original server feature space, the mapping relationship between the integrated time domain model and the original feature space is combined to build a complete probabilistic graphical model to describe the relationship between server characteristics and their behavior patterns, and finally obtain a server behavior benchmark model.

[0021] Step S300: comparing and calculating the deviation of the second server feature vector collected in real time based on the server behavior benchmark model to obtain a server status anomaly score; Specifically, feature extraction is performed on the server data collected in real time. The extraction process adopts the same feature extraction method as the first server feature vector to ensure that the data collected in real time is consistent with the data structure of the benchmark model, and the second server feature vector is obtained. The second server feature vector is input into the server behavior benchmark model. The benchmark model performs probability prediction on the real-time feature vector according to the server behavior pattern stored inside it, and outputs a normal behavior probability distribution. The probability distribution reflects the matching degree of the current server behavior relative to the normal behavior in the benchmark model, and is used to evaluate the normality of the current state of the server. Based on the normal behavior probability distribution and the second server feature vector, the log likelihood ratio is calculated. The log likelihood ratio is an indicator for evaluating the deviation size by comparing the probability value of the feature vector under the normal behavior probability distribution and the overall behavior distribution, and quantifies the deviation degree of the current server behavior relative to the normal behavior. The higher the log likelihood ratio, the greater the degree to which the current server behavior deviates from the normal behavior, and the original deviation value is obtained. The original deviation value is normalized to obtain a standardized deviation score. The standardized deviation score is compared with a preset threshold to determine whether it exceeds the threshold. If the standardized deviation score exceeds the preset threshold, it indicates that the current server behavior has deviated from the normal range and there is a potential anomaly, and a preliminary anomaly mark is obtained. Based on the preliminary anomaly mark, a sliding time window is constructed, and the frequency of continuous anomalies in the time window is counted to obtain the degree of time series anomaly. The degree of time series anomaly reflects the continuity of abnormal behavior of the server in a certain period of time, which can effectively avoid misjudgment caused by accidental fluctuations. The degree of time series anomaly and the standardized deviation score are weighted and fused to obtain a comprehensive anomaly index. An adaptive threshold algorithm is applied to the comprehensive anomaly index. The algorithm dynamically adjusts the judgment criteria according to the distribution of historical data, that is, based on the statistical distribution of historical normal behavior data, the threshold of anomaly detection is updated in real time to adapt to the server behavior mode under different time periods and different workloads, and an adaptive anomaly score is obtained. Based on the adaptive anomaly score, combined with the feature importance information in the server behavior benchmark model, the anomaly contribution of each feature dimension is calculated to obtain a multidimensional anomaly vector. The multidimensional anomaly vector is weighted and summed to obtain the server status anomaly score.

[0022] Step S400: triggering a multimodal analysis program according to the server status anomaly score, performing an in-depth evaluation on the fine-grained server status information, and obtaining a server abnormal behavior report; Specifically, a threshold is judged for the server status anomaly score. When the score exceeds the preset threshold, it indicates that the current behavior of the server is seriously abnormal, and the fine-grained data acquisition module is activated. At this time, a trigger signal is generated as an instruction to start further analysis. Based on the trigger signal, the fine-grained data acquisition module starts to collect data from multiple dimensions at the same time, including detailed network traffic logs, system call tracking data, and hardware status monitoring information. The detailed network traffic log records the detailed information of all incoming and outgoing data packets of the server, such as the source, destination, size, and protocol type of the data packet; the system call tracking data records the sequence, parameters, and return values ​​of various system calls in the operating system kernel; and the hardware status monitoring information includes key indicators such as CPU usage, memory usage, and disk read and write rates that reflect the server hardware status. The fine-grained raw data is synchronized and formatted uniformly, and data from different sources are synchronized according to the same time base and converted into a consistent format to construct a multidimensional time series data set to obtain preprocessed fine-grained data. The preprocessed fine-grained data is input into the multimodal feature extractor, which extracts relevant features from the network, system and hardware levels, such as traffic pattern features at the network level, system call pattern features at the system level, and resource usage features at the hardware level, to obtain a multimodal feature vector. A feature fusion algorithm is applied to the multimodal feature vector to integrate the features of different modalities and obtain a fused feature representation. The fused feature representation is input into the abnormal pattern detector, and the deep learning model is used to identify abnormal behavior patterns. The deep learning model can automatically learn the characteristics of abnormal behaviors from complex fused features, detect possible abnormal behavior patterns, and obtain an abnormal behavior candidate set. Based on the abnormal behavior candidate set, matching is performed in combination with the predefined abnormal behavior rule library to screen out high-confidence abnormal behaviors. The rule library contains pattern features of common abnormal behaviors, such as specific network attack behaviors, abnormal system call sequences, etc. The reliability of abnormal behaviors in the candidate set can be verified through matching to obtain a confirmed abnormal behavior set. For each abnormal behavior in the confirmed abnormal behavior set, an impact range analysis is performed to evaluate the impact of the abnormal behavior on server performance and security. This includes analyzing whether the abnormal behavior will lead to excessive consumption of server resources, data leakage or system crash, etc., to obtain the abnormal behavior impact assessment results. Based on the abnormal behavior impact assessment results, the abnormal behaviors are prioritized and classified, and behaviors with serious impact and urgent handling are given priority so that system administrators can take timely measures to obtain structured abnormal behavior descriptions, including abnormal behavior types, severity, impact range and other information, and these descriptions are associated with fine-grained original data to provide detailed analysis evidence for each abnormal behavior, and generate server abnormal behavior reports containing abnormal type, severity and detailed evidence.

[0023] Step S500: Input the server abnormal behavior report into the deep reinforcement learning algorithm for analysis to generate a server dynamic access control strategy; Specifically, feature extraction is performed on the server abnormal behavior report, and key information reflecting the current abnormal status of the server is extracted from the report, such as the type, severity, frequency of occurrence, and scope of impact of the abnormal behavior, to construct an abnormal state vector. At the same time, the current server operation status information is combined, including CPU and memory usage, network connection status, running processes, and configured security policies. The abnormal state vector is combined with the current server operation status information to construct the state space of the reinforcement learning environment and obtain a complete state representation. Based on the complete state representation, an action space including firewall rule adjustment, access permission modification, and isolation measures is defined to obtain an optional operation set. The optional operation set is input into the action encoding module, and each specific operation is converted into a numerical form to obtain the corresponding action vector. Based on the complete state representation and action vector, a deep Q network model is constructed and an initial policy network is initialized. The deep Q network is a reinforcement learning model used to solve policy optimization problems under complex state and action spaces. The role of the initial policy network is to estimate future benefits based on the current state and action. In order to improve the effectiveness and convergence speed of the strategy, the proximal policy optimization algorithm is applied to the initial policy network, and the strategy is iterated, and the network parameters are gradually updated to obtain the optimized Q value function. The proximal policy optimization algorithm is an efficient policy gradient method that can ensure that the policy will not deviate too far from the original policy when updating the policy, thus avoiding policy collapse. Based on the optimized Q-value function, the ε-greedy strategy is used for action selection. The ε-greedy strategy is a method that balances exploration and utilization. In most cases, it selects the currently estimated optimal action, but also selects random actions with a certain probability to explore new policy spaces. Through this policy selection method, the policy is continuously optimized based on the existing knowledge to obtain candidate access control policies. The candidate access control policies are input into the policy evaluation module, and the Monte Carlo method is used to simulate and evaluate the policy effect. The Monte Carlo method estimates the expected return of the policy through multiple random sampling and simulations to obtain the policy score, which reflects the performance of the current policy in different environments. Based on the policy score, the priority experience replay mechanism is used to update the deep Q network parameters and optimize the Q-value function. The priority experience replay mechanism is an improved training method that prioritizes the experience that has a greater impact on the model for training, accelerates the convergence of the model, and improves the learning efficiency of the model. The optimized Q-value function is the final Q-value function. The final Q-value function is input into the policy decoder, and the decoder maps the numerical representation of the continuous action space back to the specific server dynamic access control policy, including how to adjust firewall rules, modify access rights or implement isolation measures, etc., to generate the server access control policy.

[0024] Step S600: Establish a security information sharing channel in a heterogeneous server network based on a server dynamic access control policy, and perform a network collaborative defense operation.

[0025] Specifically, the server dynamic access control policy is parsed to extract key defense parameters, such as specific access control policies, traffic filtering rules, and response measures to potential attacks. The key defense parameters are organized into a defense policy data package, which contains the defense tasks that each node in the heterogeneous server network needs to perform. Based on the defense policy data package, a security topology map of the heterogeneous server network is constructed. Key nodes and key links in the network are identified. These nodes and links are the core switches, gateway servers or main channels for data transmission in the network. After identifying the key points and links, a security structure model of the network is formed. According to the network security structure model, a distributed security information sharing protocol is designed. Define how to exchange data in a heterogeneous server network, including details such as the data exchange format, transmission rules, and how to ensure the integrity and confidentiality of the data. In order to prevent information from being eavesdropped or tampered with during transmission, the security communication protocol is encrypted. The encryption process uses an asymmetric encryption algorithm to generate a key pair, namely a public key and a private key, to form a secure communication key set. Based on the secure communication key set, an encrypted communication tunnel is established between heterogeneous servers to form a secure information sharing network. The shared network connects different types of server nodes to form an overall security information sharing channel. The security information sharing channel is connected to each server node, and a security agent is deployed on each node. The security agent is responsible for collecting and distributing security information on each node, and can monitor the security status of the node in real time, collect various log data and security events, and transmit this information to other nodes in the network. Through the coordination of the security agent, a distributed security agent network is built in the heterogeneous server network. The agent network can effectively aggregate and share the security information of each server node to provide support for the overall security protection of the network. Based on the distributed security agent network, a collaborative defense decision algorithm is designed. The algorithm generates a global defense strategy by integrating the security information of multiple nodes, such as log records on the nodes, real-time traffic data, and abnormal behavior detection results. The global defense strategy is converted into a specific defense rule set, including access control lists and traffic filtering rules. These rules are uniformly stored in the collaborative defense rule base for each node to call and execute as needed. The collaborative defense rule base is distributed, and the corresponding defense rules are sent to each server node to generate a distributed defense configuration in the heterogeneous server network. Distributed configuration allows each node to execute defense rules according to its actual situation while ensuring the coordination and consistency of the overall defense strategy. After the distributed defense configuration is deployed on each node, each node synchronously executes defense operations, such as blocking suspicious traffic according to the access control list, or discarding abnormal traffic according to the traffic filtering rules. During the execution process, each node uploads the results and feedback data of the defense operation to the security information sharing channel for analysis and processing by the collaborative defense decision algorithm.Based on this feedback information, the defense strategy is dynamically adjusted to adapt to the ever-changing network security environment and generate a network collaborative defense operation instruction sequence.

[0026] In the embodiment of the present invention, by simultaneously monitoring and analyzing the network traffic pattern, system call sequence and hardware fingerprint, multi-dimensional verification of the device identity is achieved, greatly improving the accuracy and reliability of authentication. The server behavior benchmark model is constructed by using the time domain multiple sparse Bayesian learning algorithm, which can adaptively learn and update the normal behavior pattern of the device and effectively respond to the dynamic changes of the network environment. By comparing and calculating the deviation of the feature vectors collected in real time, combined with multimodal analysis, abnormal behavior can be identified in a timely and accurate manner, reducing the false alarm rate and missed alarm rate. The deep reinforcement learning algorithm is introduced to realize the generation of intelligent access control strategies based on abnormal behavior reports, which improves the pertinence and effectiveness of defense measures. A security information sharing channel is established in a heterogeneous server network, which realizes cross-device and cross-network collaborative defense and enhances the security of the overall network. The modular design is adopted, and the logic between each step is clear, which is easy to deploy and expand in different network environments. Through real-time data collection and analysis, continuous monitoring of device behavior is achieved, and potential security threats can be discovered and responded to in a timely manner. In the process of abnormal detection, an adaptive threshold algorithm is introduced, which can dynamically adjust the judgment criteria according to the distribution of historical data, thereby improving the flexibility and accuracy of detection. After detecting an anomaly, it can trigger fine-grained multimodal analysis to deeply evaluate the nature and impact of abnormal behavior and provide detailed basis for subsequent defense. In the collaborative defense process, encrypted communication tunnels and distributed security agent networks ensure the secure transmission and sharing of defense information to prevent information leakage and tampering.

[0027] In a specific embodiment, the process of executing step S100 may specifically include the following steps: Capture data packets on the network interface of the server device, extract the protocol type, size and timestamp information of the data packets, obtain the original data of network traffic, and segment the original data of network traffic according to predefined time windows, perform statistical analysis on the data in each time window, and obtain the network traffic feature subvector; Tracing the system calls of the operating system kernel of the server device, recording the type, parameters and return value of the system calls, obtaining the original data of the system call sequence, converting the original data of the system call sequence into the system call frequency distribution, and extracting the local sequence pattern to obtain the system call feature subvector; Collect the hardware component information of the server device, including CPU identification, memory capacity, disk serial number and network card MAC address, obtain the original hardware information, and convert the original hardware information through a hash function to generate a unique hardware fingerprint identification and obtain the hardware feature sub-vector; Performing dimensionality reduction processing on the network traffic feature subvector, the system call feature subvector, and the hardware feature subvector to obtain a feature subvector after dimensionality reduction, and normalizing the feature subvector after dimensionality reduction to obtain a normalized feature subvector; A weighted sum is performed on the normalized feature sub-vectors to obtain a comprehensive feature vector, and the comprehensive feature vector is associated with the server identity information to construct a data structure including feature data and identity information to obtain a first server feature vector.

[0028] Specifically, data packets are captured on the network interface of the server device. For example, assuming that the network interface of the server is eth0, use the tcpdump command to capture the data packets on the interface in real time. The captured data packets include all network traffic in and out of the server. Each data packet has a corresponding protocol type (such as TCP, UDP, ICMP, etc.), packet size (in bytes) and timestamp information (the specific time when the packet arrives or leaves the server), so as to obtain the raw data of the network traffic. The raw data is segmented according to the predefined time window. Assuming that the length of the time window is T (such as T=60 seconds), in each time window, all captured data packet information is aggregated for statistical analysis. For each time window, multiple statistics reflecting the characteristics of the network traffic are extracted, such as the total number of packets, the number of packets of different protocol types, the average size of the packet, the maximum size, and the peak traffic in the time window. These statistics are combined together to obtain the network traffic feature subvector in the time window, which is expressed as follows: ; in, is the network traffic feature vector, Indicates the total number of packets in the time window. and Respectively represent the number of TCP and UDP protocol packets, is the average size of packets in the time window, is the maximum size of the data packet in the time window. By performing statistical analysis on the data of each time window, a series of network traffic feature subvectors are obtained to reflect the network traffic pattern of the server in different time periods. System call tracking is performed on the operating system kernel of the server device. Real-time tracking of system calls of system processes is performed by using tools such as strace. Each system call records its type (such as open, read, write, etc.), parameters (such as file descriptors, memory addresses, number of bytes, etc.), and return values ​​(such as number of bytes read, return status code, etc.). The information of all system calls is stored as raw data of system call sequences. The raw data of system call sequences are converted into system call frequency distribution, and the frequency of occurrence of various system call types in each time window is counted. At the same time, local patterns in the system call sequence are extracted. Local patterns refer to system call sequence fragments that frequently appear in a specific time period, such as continuous "open-read-close" operations. After processing, the system call feature subvector is obtained: ; in, is the system call feature subvector, , and is the frequency of occurrence of the system call type, and It is the extracted local pattern feature. The feature vector can capture the behavior characteristics of the server at the operating system level and describe the status of the server together with the network traffic feature sub-vector. The hardware component information of the server device is collected. The hardware component information includes the CPU identification, memory capacity, disk serial number, and MAC address of the network card. The hardware information is converted into a fixed-length fingerprint identifier through a hash function (such as SHA-256) to represent the hardware feature sub-vector: ; in, represents the hardware feature vector, hash() represents the hash function, , , and Represent the CPU ID, memory capacity, disk serial number and network card MAC address respectively. The hardware feature subvector generated in this way uniquely identifies the server device and effectively protects the privacy of hardware information during data processing. The network traffic feature subvector, system call feature subvector and hardware feature subvector are subjected to dimensionality reduction processing. Dimensionality reduction processing uses methods such as principal component analysis to compress high-dimensional feature vectors into low-dimensional space to reduce feature redundancy and computational complexity while retaining most of the effective information. Assume that the feature subvector obtained after dimensionality reduction is , contains the key feature information after dimensionality reduction. In order to eliminate the dimensionality differences between different features, the feature sub-vector after dimensionality reduction is normalized. Normalization uses the maximum and minimum value normalization method to map each feature value to the range of 0 to 1. The normalized network traffic feature sub-vector, system call feature sub-vector, and hardware feature sub-vector are weighted and summed to obtain a comprehensive feature vector. Assume that the weight of the network traffic feature sub-vector is , the weight of the system call feature subvector is , the weight of the hardware feature sub-vector is , the comprehensive feature vector is expressed as: ; in, is the comprehensive feature vector, , and They are the normalized network traffic feature subvector, system call feature subvector, and hardware feature subvector, and the weights , and It represents the contribution ratio of each feature sub-vector in the comprehensive feature vector. The comprehensive feature vector is associated with the identity information of the server (such as the IP address or unique identifier of the server), and a data structure including feature data and identity information is constructed to obtain the first server feature vector.

[0029] In a specific embodiment, the process of executing step S200 may specifically include the following steps: Performing time series decomposition on the first server feature vector to obtain decomposed time series features, and constructing a multivariate autoregressive model based on the decomposed time series features to obtain an initial time series model; The initial time series model is used as prior knowledge to construct a time-domain multiple sparse Bayesian model framework to obtain a Bayesian prior model. The Bayesian prior model is then subjected to variational inference and parameter optimization is performed by maximizing the lower bound of evidence to obtain an optimized Bayesian model. Based on the optimized Bayesian model, the sparsity of the features in the time domain is calculated to obtain the time domain feature importance score, and according to the time domain feature importance score, the optimized Bayesian model is sparsely processed to obtain a time domain sparse Bayesian model; The time-domain sparse Bayesian model is sampled multiple times to generate the posterior distribution of the model parameters, and the time-domain model parameter distribution is obtained. Based on the time-domain model parameter distribution, sub-models of multiple time scales are constructed to obtain a multi-scale time-domain model set. The multi-scale time domain model set is integrated and learned, and the prediction results of different time scales are integrated to obtain the integrated time domain model. The integrated time domain model is combined with the original feature space mapping relationship to construct a complete probabilistic graph model and obtain the server behavior benchmark model.

[0030] Specifically, the first server feature vector of the server device is decomposed into a time series. Using time series decomposition techniques, such as empirical mode decomposition or variational mode decomposition, the original feature vector is decomposed into several intrinsic mode functions (IMFs), each of which represents the fluctuation pattern of the data at different time scales, to obtain the decomposed time series features. Based on the decomposed time series features, a multivariate autoregressive model is constructed to predict the current observation value by linearly combining past observation values. Assume that the decomposed time series features of the server feature vector are ,in Representative Features in time The value of is the number of feature dimensions. The multivariate autoregressive model is expressed as: ; in, Indicates the current time The characteristic vector of are the coefficient matrices of the autoregressive model, describing the impact of features at different time lags on the current features. is the lag order of the model, is the error term, which represents the noise that cannot be explained by the model. The initial time series model is obtained by training the multivariate autoregressive model. The initial time series model is used as prior knowledge to construct a time-domain multiple sparse Bayesian model framework. The Bayesian model combines prior information and observed data to make predictions through probabilistic inference. The parameters of the autoregressive model are used as prior information, and the Bayesian prior model is introduced to construct the probabilistic framework of the Bayesian model. In order to optimize the Bayesian prior model, the variational inference method is used to optimize the parameters by maximizing the lower bound of evidence. Variational inference is an approximate inference method. It is used to process complex probability models by approximating complex probability distributions (such as posterior distributions) to simple distributions (such as Gaussian distributions) and optimizing the two distributions to be as close as possible, so as to efficiently infer the model parameters. Define an optimization objective function-the lower bound of evidence to measure the degree of fit of the model. Assume is the near posterior distribution, is a joint distribution where represents the observed data, is the model parameter, and the optimization objective is expressed as: L ; Where L is the lower bound of evidence, is the expectation of the log-likelihood, is the approximate posterior distribution With the prior distribution The Kullback-Leibler (KL) divergence of the time domain is calculated. The optimized Bayesian model is obtained by maximizing the objective function. Based on the optimized Bayesian model, the sparsity of the features in the time domain is calculated, and the activity of each feature at different time points is analyzed to obtain the importance score of the time domain features. According to the importance score of the feature, the optimized Bayesian model is sparsely processed to remove the features with smaller contributions, reduce the complexity of the model, and retain the features with higher importance scores to obtain the time domain sparse Bayesian model. The time domain sparse Bayesian model is sampled multiple times to generate the posterior distribution of the model parameters. Through the Monte Carlo sampling method, multiple samples are extracted from the posterior distribution of the Bayesian model, and each sample represents a possible model parameter configuration. In this way, the time domain model parameter distribution, that is, the possible value range of the model parameters under different assumptions, is obtained. Based on the sampling results, sub-models of multiple time scales are constructed. Each sub-model corresponds to a different time scale and parameter configuration, which can capture the change pattern of server behavior in the short, medium and long term, respectively, and obtain a multi-scale time domain model set. In order to improve the prediction performance and robustness of the model, an ensemble learning of multi-scale time domain models is performed. The overall prediction accuracy and robustness are improved by integrating the prediction results of multiple models. Sub-models of different time scales are combined together, and their prediction results at different time scales are integrated through weighted average, voting and other methods to obtain an integrated time domain model. The integrated time domain model is combined with the mapping relationship of the original feature space to construct a complete probabilistic graphical model. The probabilistic graphical model can model the relationship between the time series of server features and their behavior patterns, revealing the causal relationship between features and behaviors. The probabilistic graphical model not only includes the prediction ability of the time series model, but also can show the interaction between different features and their impact on server behavior through the graph structure, and finally obtain a server behavior benchmark model.

[0031] In a specific embodiment, the process of executing step S300 may specifically include the following steps: Extracting features from the server data collected in real time to obtain a second server feature vector, and inputting the second server feature vector into a server behavior benchmark model to perform probability prediction to obtain a normal behavior probability distribution; Based on the normal behavior probability distribution and the second server feature vector, the log likelihood ratio is calculated to obtain the original deviation value, and the original deviation value is normalized to obtain a standardized deviation score; Compare the standardized deviation score with the preset threshold to determine whether it exceeds the threshold, obtain a preliminary abnormal sign, and build a sliding time window based on the preliminary abnormal sign to count the frequency of continuous abnormalities and obtain the degree of time series abnormality; The degree of time series anomaly and the standardized deviation score are weighted and fused to obtain a comprehensive anomaly index. An adaptive threshold algorithm is applied to the comprehensive anomaly index. The judgment criteria are dynamically adjusted according to the distribution of historical data to obtain an adaptive anomaly score. Based on the adaptive anomaly score and combined with the feature importance in the server behavior benchmark model, the anomaly contribution of each feature dimension is calculated to obtain a multidimensional anomaly vector, which is then weighted and summed to obtain the server status anomaly score.

[0032] Specifically, feature extraction is performed on the data collected by the server in real time to form a second server feature vector. The data collected by the server in real time includes network traffic, system call sequence, hardware status information, etc. After preprocessing, these data are subjected to feature extraction in the same manner as the first server feature vector. The feature extraction process includes statistical analysis of the protocol distribution of network traffic, data packet size and quantity, extraction of system call frequency and mode, and collection of hardware status information such as CPU usage, memory usage, etc. These features constitute the second server feature vector. The second server feature vector The server behavior benchmark model is built on the basis of the first server feature vector. After training, the model predicts the normal behavior probability distribution of the input feature vector. The normal behavior probability distribution reflects the probability that the server behavior is normal under the current feature state. Assume that the probability distribution is It indicates the matching degree between each feature in the feature vector of the second server and the normal behavior pattern. The probability of normal behavior of the server is close to 1, but when some features are abnormal, the probability distribution will deviate from the normal value. Based on the normal behavior probability distribution The log-likelihood ratio is calculated with the second server feature vector to quantify the degree of deviation of the current feature vector from normal behavior. The formula for the log-likelihood ratio is: ; in, Normal) represents the feature vector The probability under normal behavior is Abnormal) represents the probability of abnormal behavior. The larger the value of LLR, the more the current feature tends to normal behavior; conversely, if the value is small or even negative, it indicates that the feature may deviate from the normal state. The original deviation value is normalized to obtain a standardized deviation score. Normalization is achieved by mapping the original deviation value to a range of 0 to 1, so that different features are comparable during deviation analysis. The standardized deviation score is compared with the preset threshold to determine whether the current behavior is abnormal. The preset threshold is set based on historical data and security policies. When the standardized deviation score exceeds this threshold, the server behavior is considered to be abnormal and a preliminary abnormal flag is obtained. Construct a sliding time window and continuously count the frequency of abnormalities within the window. If the anomaly occurs frequently within a sliding window, the abnormal behavior of the server is considered to have temporal continuity, and the degree of temporal anomaly is obtained. The degree of temporal anomaly is weighted and fused with the standardized deviation score to obtain a comprehensive anomaly index. Let the standardized deviation score be , the degree of timing anomaly is , and their weights are and , then the comprehensive abnormal index It is expressed as: ; in, and is a weighting coefficient used to adjust the relative importance of the standardized deviation score and the degree of time series anomaly in the comprehensive anomaly index. The adaptive threshold algorithm is applied to the comprehensive anomaly index, and the judgment criteria are dynamically adjusted according to the distribution of historical data to obtain an adaptive anomaly score. The adaptive threshold algorithm dynamically adjusts the threshold according to the distribution law of historical data, so that the comprehensive anomaly index is considered abnormal only when it exceeds the adaptive threshold. Based on the adaptive anomaly score, combined with the feature importance in the server behavior benchmark model, the anomaly contribution of each feature dimension is calculated. Assume that the adaptive anomaly score is , a feature The importance rating is , then the abnormal contribution of this feature It is expressed as: ; By calculating the abnormal contribution of each feature, a multidimensional abnormal vector is obtained, which reflects the specific contribution of different features in the current abnormal behavior. The multidimensional abnormal vector is weighted and summed to obtain the server status abnormal score, which reflects the current health status and potential risks of the server. Assume that the multidimensional abnormal vector is , the weight of each feature is , then the server status anomaly score It is expressed as: ; in, is the server status anomaly score, It is The abnormal contribution of the features, It is By taking the weighted sum of the multi-dimensional anomaly vectors and comprehensively considering the contribution of each feature in the abnormal behavior, the server status evaluation index is obtained.

[0033] In a specific embodiment, the process of executing step S400 may specifically include the following steps: The server status anomaly score is judged by threshold. When it exceeds the preset threshold, the fine-grained data collection module is activated to obtain a trigger signal. Based on the trigger signal, detailed network traffic logs, system call tracking data and hardware status monitoring information are collected at the same time to obtain fine-grained original data. The fine-grained raw data is synchronized in time and formatted uniformly to construct a multidimensional time series data set to obtain preprocessed fine-grained data. The preprocessed fine-grained data is then input into a multimodal feature extractor to extract features at the network, system, and hardware levels to obtain a multimodal feature vector. Apply feature fusion algorithm to multimodal feature vectors, integrate features of different modalities, obtain fused feature representation, and input the fused feature representation into abnormal pattern detector, use deep learning model to identify abnormal behavior patterns, and obtain abnormal behavior candidate set; Based on the abnormal behavior candidate set, combined with the predefined abnormal behavior rule library, high-confidence abnormal behaviors are screened out to obtain the confirmed abnormal behavior set. The impact range of each abnormal behavior in the confirmed abnormal behavior set is analyzed to evaluate the impact on server performance and security, and the abnormal behavior impact assessment results are obtained. Based on the abnormal behavior impact assessment results, the abnormal behaviors are prioritized and classified to obtain a structured abnormal behavior description. The structured abnormal behavior description is associated with the fine-grained original data to generate a server abnormal behavior report containing the abnormal type, severity and detailed evidence.

[0034] Specifically, a threshold is determined for the server status anomaly score. Suppose the server status anomaly score is ,when Exceeding the preset threshold When (i.e. ), it is considered that the current state of the server has potential serious abnormalities and it is necessary to activate the fine-grained data collection module for further analysis. Preset threshold It is set based on the statistical properties of historical data, usually a certain percentile of the anomaly score. For example, if the threshold , and the current anomaly score , the fine-grained data collection module will be triggered, and the system will generate a trigger signal. Under the instruction of the trigger signal, the fine-grained data collection module will simultaneously start to collect multiple dimensions of data from the server, including detailed logs of network traffic, system call tracking data, and hardware status monitoring information. The detailed network traffic log records the detailed information of all incoming and outgoing packets of the server, such as the source and destination addresses of the packets, protocol type, packet size, timestamp, etc. The system call tracking data records the execution of various system calls in the operating system kernel, including the type, parameters, and return value of the system call. The hardware status monitoring information includes key indicators such as CPU utilization, memory usage, disk read and write rates, and network interface usage. The collected information together constitutes fine-grained raw data. Time synchronization and format unification are performed on the fine-grained raw data. The timestamps of each data source are standardized so that the time base of all data is consistent. Different types of data are organized in a unified format, such as using key-value pairs or multidimensional arrays for storage. Through processing, a multidimensional time series data set is constructed, which contains detailed status information of the server at the network, system, and hardware levels at each time point. The preprocessed fine-grained data is input into the multimodal feature extractor to extract features at the network, system, and hardware levels. The multimodal feature extractor uses different feature extraction algorithms, such as convolutional neural networks for processing network traffic image features, long short-term memory networks for extracting time-dependent features in system call sequences, and feature aggregation models for hardware status information extraction. Through the multimodal feature extraction method, feature vectors at the network, system, and hardware levels are obtained respectively, and they are combined into a multimodal feature vector, denoted as ,in , and Represent the feature vectors at the network, system and hardware levels respectively. Perform feature fusion and use feature fusion algorithms to integrate features of different modalities. The feature fusion algorithm uses weighted average, principal component analysis, autoencoder and other methods to fuse feature information of different modalities into a unified representation, that is, fused feature representation. The fusion feature representation can comprehensively reflect the state characteristics of the server at all levels. The input is sent to the abnormal pattern detector, which uses a deep learning model to identify potential abnormal behavior patterns. The abnormal pattern detector uses models such as convolutional neural networks, recurrent neural networks, or self-attention mechanisms to automatically learn the pattern features of abnormal behavior from the fusion features, and perform classification or regression prediction to obtain an abnormal behavior candidate set. Based on the abnormal behavior candidate set , combined with the predefined abnormal behavior rule library for matching, to screen out abnormal behaviors with high confidence. The abnormal behavior rule library contains common abnormal behavior patterns and their characteristics in history, such as characteristic patterns of network attacks, patterns of abnormal system resource usage, etc. Through rule matching, abnormal behaviors that meet the known patterns are selected from the candidate set, and a confidence level is assigned to each abnormal behavior. Abnormal behaviors with higher confidence levels will be added to the confirmed abnormal behavior set. , which means that these behaviors are likely to be the source of abnormalities in the current server status. For each abnormal behavior in the confirmed abnormal behavior set, an impact range analysis is performed to evaluate its impact on server performance and security. Impact range analysis includes evaluating whether the abnormal behavior has caused excessive consumption of server resources, such as high CPU and memory usage, whether it has caused a decline in network performance, such as abnormal traffic increase, and whether there are potential security risks, such as data leakage or malicious operations. By quantifying these influencing factors, the impact assessment results of each abnormal behavior are obtained, reflecting the overall impact of the abnormal behavior on the server. Prioritize and classify the abnormal behaviors based on the evaluation results. The order of processing is determined according to the impact of the abnormal behavior on the system, and abnormal behaviors with greater impact will be given higher priority. Classification is to classify different types of abnormal behaviors, such as resource occupation anomalies, network attack anomalies, and system call anomalies, to obtain a structured abnormal behavior description, which includes information such as the type, severity, priority, and detailed impact analysis of the abnormal behavior. The structured abnormal behavior description is associated with fine-grained raw data to generate a server abnormal behavior report. The abnormal behavior report records the occurrence time, relevant characteristic data, abnormal type, severity and specific impact on the system of each abnormal behavior.

[0035] In a specific embodiment, the process of executing step S500 may specifically include the following steps: Extract features from abnormal behavior reports of servers to obtain abnormal state vectors, and combine the abnormal state vectors with the current server operation status information to construct the state space of the reinforcement learning environment and obtain a complete state representation; Based on the complete state representation, an action space including firewall rule adjustment, access permission modification and isolation measures is defined to obtain an optional operation set, which is then input into the action encoding module and converted into a numerical representation to obtain an action vector. Based on the complete state representation and action vector, a deep Q network model is constructed to obtain the initial policy network. The proximal policy optimization algorithm is applied to the initial policy network to perform policy iteration to obtain the optimized Q value function. Based on the optimized Q-value function, the ε-greedy strategy is used to select the optimal action to obtain the candidate access control strategy, and the candidate access control strategy is input into the strategy evaluation module. The Monte Carlo method is used to evaluate the strategy effect and obtain the strategy score. Based on the policy score, the priority experience replay mechanism is used to update the deep Q network parameters to obtain the final Q-value function, which is then input into the policy decoder to map the continuous action space into a dynamic access control policy for the server.

[0036] Specifically, feature extraction is performed on the server abnormal behavior report to form an abnormal state vector. The server abnormal behavior report contains information of multiple dimensions, such as the type of abnormal behavior, the time period of occurrence, the resources affected (such as CPU, memory, network traffic, etc.), and the severity of the behavior (such as minor, general, severe, etc.). This information is converted into a structured data representation to form a high-dimensional abnormal state vector. Let the abnormal state vector be ,in Indicates The value of the feature, is the number of dimensions of the feature. The abnormal state vector is combined with the current server's operating status information to construct the state space of the reinforcement learning environment. The current server's operating status information includes the current system's resource usage, network connection status, process and service status, etc. This information is extracted as the current state vector ,in Indicates The value of the operating status characteristic, is the dimension of the current state. With the current state vector Splice to get a complete state representation Based on the complete state representation , define the action space, which includes possible operations such as firewall rule adjustment, access permission modification and isolation measures. Each operation is refined into several sub-operations, for example, firewall rule adjustment includes "blocking a certain IF address" and "limiting access to a certain port". Organize all possible operations to form a set of optional operations ,in Indicates possible operations, is the size of the action space. In order to be able to input discrete actions into the reinforcement learning model, they are encoded and the discrete set of operations is converted into numerical representation. The action encoding module converts each operation Mapped to an action vector For example, if the action space includes "blocking IP address", "limiting port access" and "process isolation", the encoding is: Through the encoding method, the numerical action vector is obtained. Based on the complete state representation and motion vector , build a deep Q network model. The deep Q network model is a reinforcement learning model based on Q learning, which uses neural networks to approximate the Q value function and realize the value evaluation of state-action pairs. Used to indicate the status Next select action The expected return that can be obtained. The input of the neural network is the state vector and motion vector , the output is the Q value corresponding to each action. The initial policy network is represented by a deep neural network initialized with random weights, and the initial Q value function is obtained ,in is the weight parameter of the network. On the initialized policy network, the proximal policy optimization algorithm is applied to perform policy iteration. The proximal policy optimization algorithm is a policy optimization method that improves the stability of policy updates by constraining the changes between the new and old policies. Define an optimization objective function, namely: ; in, Is the current strategy in state Select Action The probability of is the probability under the old strategy, is the advantage function, used to evaluate actions How good is the strategy relative to the average? is a hyperparameter that controls the range of the strategy. By maximizing the objective function, the optimized Q value function is obtained. Based on the optimized Q value function, -Greedy strategy chooses the optimal action. - Greedy strategy is a method that balances choosing the optimal strategy with exploration. The probability of selecting the action with the highest current Q value is The probability of selecting random actions is to strike a balance between exploring new strategies and using existing strategies. In this way, a candidate access control strategy is obtained. In order to evaluate the effectiveness of candidate access control policies, they are input into the policy evaluation module for evaluation. Policy evaluation is implemented through the Monte Carlo method, that is, running the candidate policies multiple times in the simulation environment, calculating their average benefits in different scenarios, and obtaining the policy score. , reflecting the performance of candidate strategies in different situations. Based on strategy scoring , use the priority experience replay mechanism to update the parameters of the deep Q network. The priority experience replay mechanism is a reinforcement learning method based on experience priority. It accelerates the convergence of the model by giving priority to samples that have a greater impact on the model for training. Add the policy samples with higher scores to the experience pool, and randomly sample a batch of data from it to train the deep Q network and update its parameters. , and obtain the final Q-value function. The final Q-value function is input into the policy decoder, and the policy decoder maps the continuous action space into the dynamic access control policy of the server. The policy decoder generates a specific control policy based on the output of the Q-value function, combined with the current state of the server and policy requirements. For example, if the output of the Q-value function indicates that the optimal policy is "blocking a certain IP address and restricting access to a certain port" in the current state, the decoder will convert these policies into specific firewall rules and automatically apply them to the server.

[0037] In a specific embodiment, the process of executing step S600 may specifically include the following steps: Analyze the server dynamic access control policy, extract key defense parameters, obtain defense policy data packets, and build a security topology map of the heterogeneous server network based on the defense policy data packets, identify key nodes and links, and obtain a network security structure model; According to the network security structure model, a distributed security information sharing protocol is designed, data exchange format and transmission rules are defined, a secure communication protocol is obtained, and the secure communication protocol is encrypted, and a key pair is generated using an asymmetric encryption algorithm to obtain a secure communication key set; Based on the secure communication key set, an encrypted communication tunnel is established between heterogeneous servers to form a secure information sharing network, obtain a secure information sharing channel, and connect the secure information sharing channel to each server node, deploy a secure agent program, realize information collection and distribution, and obtain a distributed secure agent network; Based on the distributed security agent network, a collaborative defense decision algorithm is designed to integrate the security information of multiple nodes to obtain a global defense strategy, and then the global defense strategy is converted into a specific defense rule set, including access control lists and traffic filtering rules, to obtain a collaborative defense rule base; The collaborative defense rule library is distributed, and the corresponding defense rules are sent to each server node to obtain a distributed defense configuration. Based on the distributed defense configuration, defense operations are synchronously executed on each node, and execution feedback is collected to dynamically adjust the defense strategy to obtain a network collaborative defense operation instruction sequence.

[0038] Specifically, the server dynamic access control policy is parsed. The server dynamic access control policy usually contains a series of defense measures and configuration commands, which are used to implement security policies in the server environment. By parsing these policies, key defense parameters such as access control rules, firewall policies, traffic filtering conditions, and isolation measures are extracted. The extracted defense parameters are organized into a defense policy data packet, which is expressed in the following format: ; in, Represents an access control list, including rules for allowing or denying access to specific IP addresses and ports; Represents firewall rules, including rules that allow or block the transmission of specific packets; Indicates traffic filtering rules, used to detect and filter abnormal traffic; Represents an isolation policy, including measures to isolate a server from the network when a threat is detected. Through structured representation, complex defense policies are simplified to a set of key parameters. , build a security topology map of a heterogeneous server network. The security topology map describes the nodes, connection relationships, and distribution of security policies in the server network. A heterogeneous server network contains different types of servers, such as application servers, database servers, file servers, etc., which communicate through various protocols and network devices. In order to build a security topology map, identify the role of each server node, its adjacent nodes, and the network links through which data is transmitted. Key nodes refer to servers or devices that play a core role in the network, such as switches, firewalls, etc., which have a significant impact on the security of the network. A critical link refers to a path that carries a large amount of important data flows in the network. By analyzing this information, a network security structure model is obtained, using a graph structure Indicates that Is a collection of server nodes Is the connection relationship between nodes. Identify key nodes and key links Finally, design security policies for key nodes and links. Based on the constructed network security structure model, design a distributed security information sharing protocol. This protocol is used to implement security information interaction between different nodes in a heterogeneous server network and define the format and transmission rules for data exchange. Determine the data exchange format, for example, standardize different types of security information (such as attack detection logs, traffic statistics, node status) into a unified data format and encapsulate them in JSON or XML. Determine transmission rules, including data encryption, transmission path selection, message retransmission strategy, etc. In order to ensure the security of data transmission, encrypt the secure communication protocol. Use an asymmetric encryption algorithm (such as RSA) to generate a public and private key pair to form a secure communication key set. ,in is the public key, used to encrypt messages, It is a private key used to decrypt messages. Each server node has a public-private key pair to ensure the confidentiality and integrity of data transmission. , establish encrypted communication tunnels between heterogeneous servers. Encrypted communication tunnels are used to establish secure data transmission channels between different server nodes to prevent data from being eavesdropped or tampered with. Deploy a secure communication agent on each node to manage encrypted communications with other nodes, including key exchange, message encryption and decryption, and other operations. Through the agent, connect the various server nodes to form a security information sharing network, obtain a security information sharing channel, and use it to share the security information of each node in real time to provide data support for the formulation of global defense strategies. Based on the security information sharing channel, deploy a security agent on each server node to collect and distribute information. The security agent monitors the running status of the server, collects security event logs, and executes defense strategies. Each server node can not only perceive its own security status, but also obtain security information of other nodes through the security information sharing channel, forming a distributed security agent network, so that each node can automatically adjust its own defense strategy when receiving threat information. Based on the distributed security agent network, design a collaborative defense decision algorithm. The collaborative defense decision algorithm evaluates the global network security situation and formulates a global defense strategy by integrating the security information of multiple nodes. The collaborative defense decision algorithm uses machine learning or optimization algorithms to dynamically adjust defense strategies based on real-time collected security information and historical data. The global defense strategy includes access control, traffic management, resource scheduling and other measures for the entire network. These strategies are converted into specific defense rule sets, such as access control lists, traffic filtering rules, etc., and stored in the collaborative defense rule base. The rules in the collaborative defense rule base are distributed to each server node to form a distributed defense configuration. Each server node applies different defense rules according to its role and location. The distributed defense configuration ensures that each node can work together in the face of threats and improves the defense capabilities of the entire network. In the process of synchronously executing defense operations on each node, feedback information of the execution is collected in real time. The feedback information includes the execution effect of the defense rules, whether the threat is blocked, whether the network performance is affected, etc. This information is collected in the distributed security agent network as the basis for optimizing the defense strategy. According to the collected feedback information, the defense strategy is dynamically adjusted. By analyzing the execution effect of defense rules, the collaborative defense decision algorithm selects more effective strategies in the rule base, or adjusts the parameters of existing strategies, and obtains a network collaborative defense operation instruction sequence, including a series of specific defense measures, such as updating firewall rules, adjusting access rights, and starting isolation mechanisms. The instruction sequence is distributed to each node and executed by the security agent program to achieve dynamic response and continuous defense against network threats.

[0039] See also Figure 2 , Figure 2 A schematic block diagram of the structure of the device access authentication device 200 provided in the embodiment of the present application is shown in FIG. Figure 2As shown, the device access authentication device 200 includes: A monitoring module 210 is used to monitor and collect network traffic patterns, system call sequences, and hardware fingerprints of the server device to obtain a first server feature vector; A processing module 220, configured to input the first server feature vector into a time-domain multiple sparse Bayesian learning algorithm for processing to obtain a server behavior benchmark model; A calculation module 230 is used to compare and calculate the deviation of the second server feature vector collected in real time based on the server behavior benchmark model to obtain a server status anomaly score; An evaluation module 240 is used to trigger a multimodal analysis program according to the server status anomaly score, conduct an in-depth evaluation of fine-grained server status information, and obtain a server abnormal behavior report; Analysis module 250, used to input the server abnormal behavior report into the deep reinforcement learning algorithm for analysis and generate a server dynamic access control policy; The execution module 260 is used to establish a security information sharing channel in a heterogeneous server network based on a server dynamic access control policy and perform network collaborative defense operations.

[0040] Through the collaboration of the above components, by simultaneously monitoring and analyzing network traffic patterns, system call sequences and hardware fingerprints, multi-dimensional verification of device identity is achieved, greatly improving the accuracy and reliability of authentication. The server behavior benchmark model is constructed using the time domain multiple sparse Bayesian learning algorithm, which can adaptively learn and update the normal behavior pattern of the device and effectively respond to the dynamic changes of the network environment. By comparing and calculating the deviation of the feature vectors collected in real time, combined with multimodal analysis, abnormal behaviors can be identified in a timely and accurate manner, reducing the false alarm rate and missed alarm rate. The introduction of deep reinforcement learning algorithm realizes the generation of intelligent access control strategies based on abnormal behavior reports, improving the pertinence and effectiveness of defense measures. Establishing a security information sharing channel in a heterogeneous server network realizes cross-device and cross-network collaborative defense and enhances the security of the overall network. The modular design is adopted, and the logic between each step is clear, which is easy to deploy and expand in different network environments. Through real-time data collection and analysis, continuous monitoring of device behavior is achieved, and potential security threats can be discovered and responded to in a timely manner. In the process of anomaly detection, the introduction of adaptive threshold algorithm can dynamically adjust the judgment criteria according to the distribution of historical data, improving the flexibility and accuracy of detection. After detecting an anomaly, it can trigger fine-grained multimodal analysis to deeply evaluate the nature and impact of abnormal behavior and provide detailed basis for subsequent defense. In the collaborative defense process, encrypted communication tunnels and distributed security agent networks ensure the secure transmission and sharing of defense information to prevent information leakage and tampering.

[0041] The present application also provides a device access authentication device, which includes a memory and a processor. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor executes the steps of the device access authentication method in the above-mentioned embodiments.

[0042] The present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the device access authentication method.

[0043] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0044] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0045] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A device access authentication method, characterized in that: include: Monitor and collect network traffic patterns, system call sequences, and hardware fingerprints of the server device to obtain a first server feature vector; Inputting the first server feature vector into a time-domain multiple sparse Bayesian learning algorithm for processing to obtain a server behavior benchmark model; Comparing and calculating the deviation of the second server feature vector collected in real time based on the server behavior benchmark model to obtain a server status anomaly score; triggering a multimodal analysis program according to the server status anomaly score to conduct an in-depth evaluation of fine-grained server status information and obtain a server abnormal behavior report; Inputting the server abnormal behavior report into a deep reinforcement learning algorithm for analysis to generate a server dynamic access control strategy; Based on the server dynamic access control strategy, a security information sharing channel is established in a heterogeneous server network to perform network collaborative defense operations.

2. The device access authentication method according to claim 1, characterized in that: The monitoring and collection of the network traffic pattern, system call sequence and hardware fingerprint of the server device to obtain the first server feature vector includes: Capturing data packets on the network interface of the server device, extracting the protocol type, size and timestamp information of the data packets, obtaining raw network traffic data, and segmenting the raw network traffic data according to predefined time windows, performing statistical analysis on the data in each time window, and obtaining a network traffic feature subvector; Tracing system calls on the operating system kernel of the server device, recording the type, parameters and return value of the system calls, obtaining original data of the system call sequence, converting the original data of the system call sequence into a system call frequency distribution, and extracting local sequence patterns to obtain a system call feature subvector; Collecting hardware component information of the server device, including CPU identification, memory capacity, disk serial number and network card MAC address, to obtain original hardware information, and converting the original hardware information through a hash function to generate a unique hardware fingerprint identification to obtain a hardware feature subvector; Performing dimensionality reduction processing on the network traffic feature subvector, the system call feature subvector, and the hardware feature subvector to obtain a feature subvector after dimensionality reduction, and normalizing the feature subvector after dimensionality reduction to obtain a normalized feature subvector; A weighted sum is performed on the normalized feature sub-vectors to obtain a comprehensive feature vector, and the comprehensive feature vector is associated with the server identity information to construct a data structure including feature data and identity information to obtain a first server feature vector.

3. The device access authentication method according to claim 1, characterized in that: The step of inputting the first server feature vector into a time-domain multiple sparse Bayesian learning algorithm for processing to obtain a server behavior benchmark model includes: Performing time series decomposition on the first server feature vector to obtain decomposed time series features, and constructing a multivariate autoregressive model based on the decomposed time series features to obtain an initial time series model; Taking the initial time series model as prior knowledge, constructing a time-domain multiple sparse Bayesian model framework to obtain a Bayesian prior model, performing variational inference on the Bayesian prior model, optimizing parameters by maximizing the lower bound of evidence, and obtaining an optimized Bayesian model; Based on the optimized Bayesian model, the sparsity of the feature in the time domain is calculated to obtain a time domain feature importance score, and according to the time domain feature importance score, the optimized Bayesian model is subjected to sparse processing to obtain a time domain sparse Bayesian model; The time-domain sparse Bayesian model is sampled multiple times to generate a posterior distribution of model parameters to obtain a time-domain model parameter distribution, and based on the time-domain model parameter distribution, sub-models of multiple time scales are constructed to obtain a multi-scale time-domain model set; The multi-scale time domain model set is integrated and learned, and the prediction results of different time scales are integrated to obtain an integrated time domain model. The integrated time domain model is combined with the original feature space mapping relationship to construct a complete probabilistic graph model to obtain a server behavior benchmark model.

4. The device access authentication method according to claim 1, characterized in that: The comparing and calculating the deviation of the second server feature vector collected in real time based on the server behavior benchmark model to obtain a server status anomaly score includes: Extracting features from the server data collected in real time to obtain a second server feature vector, and inputting the second server feature vector into a server behavior benchmark model to perform probability prediction to obtain a normal behavior probability distribution; Based on the normal behavior probability distribution and the second server feature vector, a log likelihood ratio is calculated to obtain an original deviation value, and the original deviation value is normalized to obtain a standardized deviation score; Compare the standardized deviation score with a preset threshold to determine whether it exceeds the threshold, obtain a preliminary abnormality mark, and based on the preliminary abnormality mark, construct a sliding time window, count the frequency of continuous abnormalities, and obtain the degree of time series abnormality; The time series anomaly degree and the standardized deviation score are weighted and merged to obtain a comprehensive anomaly index, and an adaptive threshold algorithm is applied to the comprehensive anomaly index to dynamically adjust the judgment standard according to the historical data distribution to obtain an adaptive anomaly score; Based on the adaptive anomaly score and in combination with the feature importance in the server behavior benchmark model, the anomaly contribution of each feature dimension is calculated to obtain a multidimensional anomaly vector, and the multidimensional anomaly vector is weighted and summed to obtain a server status anomaly score.

5. The device access authentication method according to claim 4, characterized in that: The multimodal analysis program is triggered according to the server status anomaly score to conduct an in-depth evaluation of the fine-grained server status information to obtain a server abnormal behavior report, including: A threshold is judged on the server status abnormality score, and when it exceeds a preset threshold, a fine-grained data collection module is activated to obtain a trigger signal, and based on the trigger signal, detailed network traffic logs, system call tracking data and hardware status monitoring information are collected at the same time to obtain fine-grained original data; Performing time synchronization and format unification processing on the fine-grained raw data, constructing a multidimensional time series data set, obtaining preprocessed fine-grained data, and inputting the preprocessed fine-grained data into a multimodal feature extractor to extract features at the network, system and hardware levels, respectively, to obtain a multimodal feature vector; Applying a feature fusion algorithm to the multimodal feature vector to integrate features of different modalities to obtain a fused feature representation, and inputting the fused feature representation into an abnormal pattern detector to identify abnormal behavior patterns using a deep learning model to obtain an abnormal behavior candidate set; Based on the abnormal behavior candidate set, matching is performed in combination with a predefined abnormal behavior rule library, high-confidence abnormal behaviors are screened out to obtain a confirmed abnormal behavior set, and an impact range analysis is performed on each abnormal behavior in the confirmed abnormal behavior set to evaluate the impact on server performance and security, and obtain an abnormal behavior impact assessment result; Based on the abnormal behavior impact assessment result, the abnormal behavior is prioritized and classified to obtain a structured abnormal behavior description, and the structured abnormal behavior description is associated with the fine-grained original data to generate a server abnormal behavior report containing the abnormal type, severity and detailed evidence.

6. The device access authentication method according to claim 5, characterized in that: The inputting the server abnormal behavior report into the deep reinforcement learning algorithm for analysis to generate a server dynamic access control strategy includes: Extract features from the abnormal behavior report of the server to obtain an abnormal state vector, and combine the abnormal state vector with the current server operation state information to construct a reinforcement learning environment state space to obtain a complete state representation; Based on the complete state representation, an action space including firewall rule adjustment, access permission modification and isolation measures is defined to obtain an optional operation set, and the optional operation set is input into an action encoding module and converted into a numerical representation to obtain an action vector; Based on the complete state representation and the action vector, a deep Q network model is constructed to obtain an initial policy network, and a proximal policy optimization algorithm is applied to the initial policy network to perform policy iteration to obtain an optimized Q value function; Based on the optimized Q-value function, an ε-greedy strategy is used to select the optimal action to obtain a candidate access control strategy, and the candidate access control strategy is input into a strategy evaluation module, and the strategy effect is evaluated by a Monte Carlo method to obtain a strategy score; Based on the policy score, the deep Q network parameters are updated using a priority experience replay mechanism to obtain a final Q value function, and the final Q value function is input into a policy decoder to map the continuous action space into a server dynamic access control policy.

7. The device access authentication method according to claim 1, characterized in that: The method of establishing a security information sharing channel in a heterogeneous server network based on the server dynamic access control strategy and performing a network collaborative defense operation includes: Parsing the server dynamic access control policy, extracting key defense parameters, obtaining a defense policy data packet, and constructing a security topology map of the heterogeneous server network based on the defense policy data packet, identifying key nodes and links, and obtaining a network security structure model; According to the network security structure model, a distributed security information sharing protocol is designed, a data exchange format and transmission rules are defined, a secure communication protocol is obtained, and the secure communication protocol is encrypted, a key pair is generated using an asymmetric encryption algorithm, and a secure communication key set is obtained; Based on the secure communication key set, an encrypted communication tunnel is established between heterogeneous servers to form a secure information sharing network, thereby obtaining a secure information sharing channel, and the secure information sharing channel is connected to each server node, and a secure agent program is deployed to realize information collection and distribution, thereby obtaining a distributed secure agent network; Based on the distributed security proxy network, a collaborative defense decision algorithm is designed to integrate the security information of multiple nodes to obtain a global defense strategy, and the global defense strategy is converted into a specific defense rule set, including an access control list and traffic filtering rules, to obtain a collaborative defense rule base; The collaborative defense rule library is distributed, and the corresponding defense rules are sent down to each server node to obtain a distributed defense configuration. Based on the distributed defense configuration, defense operations are synchronously executed at each node, and execution feedback is collected to dynamically adjust the defense strategy to obtain a network collaborative defense operation instruction sequence.

8. A device access authentication device, characterized in that: The method for performing device access authentication according to any one of claims 1 to 7 comprises: A monitoring module, used to monitor and collect network traffic patterns, system call sequences, and hardware fingerprints of the server device to obtain a first server feature vector; A processing module, configured to input the first server feature vector into a time-domain multiple sparse Bayesian learning algorithm for processing to obtain a server behavior benchmark model; A calculation module, used for comparing and calculating the deviation of the second server feature vector collected in real time based on the server behavior benchmark model to obtain a server status anomaly score; An evaluation module, configured to trigger a multimodal analysis program according to the server status anomaly score, conduct an in-depth evaluation of fine-grained server status information, and obtain a server abnormal behavior report; An analysis module is used to input the server abnormal behavior report into a deep reinforcement learning algorithm for analysis and generate a server dynamic access control strategy; The execution module is used to establish a security information sharing channel in a heterogeneous server network based on the server dynamic access control strategy and perform network collaborative defense operations.

9. A device access authentication device, characterized in that: The device access authentication device comprises: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instruction in the memory to enable the device access authentication device to execute the device access authentication method according to any one of claims 1 to 7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the device access authentication method according to any one of claims 1 to 7 is implemented.

Images